No, it's not compulsory, but you have to be extremely careful if you don't.
HTTPS can stop man in the middle attacks, which HTTP is very vulnerable to.
However, HTTPS carries a processor (and hence speed) overhead. HTTPS causes out-of-session data to not be cached and hence can have re-download content with each visit. It also stops you from using (or makes it much harder to use) content delivery networks.
So lots of sites try to get by without it, but it's a dangerous line as mixing HTTP and HTTPS is very risky - you have to use HTTPS authentication cookies, which means that your user will only be logged on when visiting HTTPS pages.
If you ever let an HTTPS authentication cookie be sent to an HTTP page then you've left open an easy attack route for hackers.
What many sites do is this:
- Anonymous users can browse the e-shop, and build up a shopping basket
- Once they proceed to checkout or log in they're switched to the (slower) HTTPS secure version.
- They're given an HTTPS-only authentication cookie, and sometimes an HTTP cookie too with just the username.
This is what Amazon does - cookies holding your username and basket are not secure and can be easily nicked, but you have to sign in to the HTTPS area (or have a valid, unexpired HTTPS cookie) to buy anything or view your account.
That's a fine line though, you need good (highly security aware) developers and support staff. For most sites it's a lot easier and lower risk to just HTTPS everything.
I don't think my answer above is right any more. HTTPS is now compulsory, for a couple of reasons:
- HTTP/2 means secure sites are often significantly faster.
- Various advanced features are HTTPS only, such as service workers.
- Google Chrome (and probably other browsers soon) are increasingly flagging sites that don't use HTTPS. By 2017, rather than just the green padlock, sites without HTTPS will display a warning: